Datenschutzerklärung

VHUES BEAUTY PRIVACY POLICY

Effective Date: April 4, 2025
Last Updated: August 24, 2026

VHUES BEAUTY (“VHUES,” “we,” “us,” or “our”) operates vhues.ca and related services, features, customer accounts, forms, communications, and commerce functionality collectively referred to in this Privacy Policy as the “Services.”

Our online store is powered by Shopify.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information, as well as the privacy rights and choices that may be available to you.

Where consent is required by applicable law, we will seek consent for the relevant collection, use, disclosure, or technology.

If this Privacy Policy conflicts with our Terms of Service on a matter concerning the collection, use, disclosure, retention, or protection of personal information, this Privacy Policy controls for that matter.

Change Notes

August 24, 2026

  • Clarified the application of British Columbia's Personal Information Protection Act (PIPA) and Canada's federal Personal Information Protection and Electronic Documents Act (PIPEDA) where applicable

  • Updated data-breach language to account for different statutory notification thresholds

  • Revised European Economic Area and United Kingdom territorial-scope and representative language

  • Clarified privacy accountability and the distinction between an internal privacy contact and a statutory Data Protection Officer

  • Updated Shopify Inbox and AI-assisted chat disclosures

  • Simplified children's privacy language

  • Clarified U.S. sale, sharing, and targeted-advertising terminology

  • Added return, cancellation, and customer-support information to relevant processing descriptions

August 16, 2026

Added disclosure regarding Shopify Inbox and AI-assisted customer chat.

March 6, 2026

Removed references to the former ReVHUES Beauty Program following its discontinuation. No change to core privacy rights.

February 2, 2026

Administrative updates to business contact information and alignment with current fulfillment and shipping operations. No change to core privacy rights.

October 8, 2025

Removed references to the former Try-On program following its discontinuation.

1) Scope & Definitions

This Privacy Policy applies to personal information handled by VHUES in connection with the Services.

Personal information means information about an identified or reasonably identifiable individual and, where applicable under certain privacy laws, may include information linked to a household.

Sensitive personal information may include categories of information treated as sensitive or specially protected under applicable law, such as:

  • Precise geolocation

  • Government-issued identifiers

  • Financial account information combined with credentials that permit access

  • Certain health, biometric, or genetic information

  • Racial or ethnic origin

  • Religious or philosophical beliefs

  • Trade union membership

  • Sexual orientation or information concerning sex life

  • Certain information concerning children

  • Other categories defined as sensitive under applicable law

The terms “sell,” “share,” and “targeted advertising” have the meanings assigned to them under applicable U.S. state privacy laws where those laws apply.

Browsing vhues.ca does not generally require a customer account.

Certain features, such as order management, returns, cancellation requests, forms, quizzes, or personalized services, may require additional information.

1.1 Children's Privacy

The Services are not directed primarily to children.

VHUES does not knowingly collect personal information from children in circumstances where parental or guardian consent or authorization is required by applicable law without obtaining the required authorization.

If you believe a child has provided personal information to VHUES inappropriately, contact:

privacy@vhues.ca

We will review the request and take appropriate action where required.

2) Personal Information We Collect

The information we collect depends on how you interact with VHUES and the Services.

Contact & Account Information

This may include:

  • Name

  • Email address

  • Telephone number

  • Billing address

  • Shipping address

  • Customer account information

  • Preferences

  • Account identifiers and authentication information handled through Shopify

VHUES does not receive or store your Shopify account password in readable form.

Orders, Returns, Cancellations & Customer Support

This may include:

  • Products viewed

  • Products added to cart

  • Products purchased

  • Products returned

  • Order numbers and transaction identifiers

  • Fulfillment and shipping status

  • Return or cancellation status

  • Customer-service correspondence

  • Refund information

  • Information submitted to verify damaged, defective, incorrect, missing, or mis-shipped items

  • Photos, videos, or other supporting material voluntarily submitted in connection with a support request

Materials submitted solely to resolve a customer-service, return, refund, shipping, safety, or order issue are not treated as marketing content merely because they are provided to VHUES.

Payment Information

Payments are processed through Shopify and other payment providers made available at checkout.

Depending on the payment method, processors may handle information such as:

  • Payment card information

  • Billing information

  • Payment tokens

  • Transaction information

  • Fraud-prevention data

VHUES does not store complete payment-card numbers or card security codes on its own systems.

Device, Browser & Usage Information

This may include:

  • IP address

  • Browser type

  • Device type

  • Operating system

  • Referral URL

  • Pages viewed

  • Site interactions

  • Cookie and similar identifiers

  • Approximate location derived from IP address

  • Events associated with use of the Services

Precise geolocation is collected only where a feature, device, provider, or customer choice enables it and where legally permitted.

Quizzes & Forms

Information voluntarily provided through the True Match Quiz, Typeform, or other VHUES forms may include:

  • Product preferences

  • Shade-related information

  • Undertone or depth responses

  • Beauty preferences

  • Routine information

  • Other responses requested in the applicable form

Chat & Communications

When you communicate with VHUES through email, Shopify Inbox, forms, or other support tools, we may process:

  • The content of your communication

  • Contact details

  • Order information

  • Chat metadata

  • Relevant customer account information

  • Information voluntarily provided during the conversation

Inferences

We may derive limited inferences from information you provide or your interactions with the Services, such as:

  • Shade or undertone guidance

  • Product preferences

  • Routine preferences

  • Campaign or content affinity

  • Likely interests based on site interactions

We do not use these inferences to make decisions that produce legal or similarly significant effects about customers.

3) Sources of Personal Information

We may receive personal information from:

You

Including through:

  • Checkout

  • Customer accounts

  • Return or cancellation requests

  • Customer support

  • Quizzes

  • Forms

  • Reviews

  • Marketing sign-ups

  • Chat

  • Other direct interactions

Automated Technologies

Including:

  • Cookies

  • Pixels

  • Tags

  • SDKs

  • Similar technologies

Shopify & Service Providers

Including providers supporting:

  • Ecommerce

  • Payments

  • Fraud prevention

  • Fulfillment

  • Delivery

  • Analytics

  • Customer communications

  • Reviews

  • Marketing

Advertising & Analytics Partners

Where permitted by applicable law and, where required, subject to your consent or opt-out choices.

4) Why We Use Personal Information

We use personal information only for purposes that are appropriate and permitted under applicable law.

These purposes may include:

Providing the Services

Including:

  • Processing orders

  • Taking payments

  • Managing customer accounts

  • Fulfilling orders

  • Shipping products

  • Providing tracking

  • Processing returns

  • Processing cancellation requests

  • Issuing refunds

  • Responding to support requests

  • Providing product or shade guidance

Security & Fraud Prevention

Including:

  • Detecting suspicious transactions

  • Preventing fraud

  • Protecting customer accounts

  • Protecting VHUES systems

  • Enforcing legitimate security measures

Improving the Services

Including:

  • Understanding website performance

  • Improving navigation

  • Improving customer support

  • Evaluating product and content engagement

  • Troubleshooting technical issues

  • Improving customer experience

Marketing & Measurement

Where permitted, including:

  • Email marketing

  • SMS marketing

  • Advertising measurement

  • Campaign attribution

  • Retargeting

  • Audience measurement

  • Understanding marketing effectiveness

Marketing consent may be withdrawn at any time through the method provided in the communication or by contacting us.

Compliance & Legal Obligations

Including:

  • Tax and accounting requirements

  • Consumer-protection obligations

  • Privacy obligations

  • Fraud investigation

  • Responding to lawful requests

  • Establishing, exercising, or defending legal rights

4.1 Legal Bases for EEA & UK Processing

Where the European Union GDPR or UK GDPR applies to a particular processing activity, the applicable legal basis may include:

Contract

Where processing is necessary to:

  • Process an order

  • Deliver products

  • Manage an account

  • Process a return

  • Handle a cancellation

  • Provide requested customer support

  • Take steps requested before entering into a transaction

Legitimate Interests

Where appropriate and not overridden by the individual's rights, such as:

  • Fraud prevention

  • Security

  • Service improvement

  • Certain analytics

  • Business administration

  • Understanding service performance

Consent

Where consent is required, including for:

  • Certain marketing activities

  • Certain non-essential cookies or tracking technologies

  • Other processing where consent is the appropriate lawful basis

Consent may be withdrawn where applicable.

Legal Obligation

Where processing is necessary to comply with legal requirements, including:

  • Tax

  • Accounting

  • Consumer protection

  • Privacy

  • Regulatory requirements

Other lawful bases may apply where permitted by applicable law.

5) Cookies, Pixels, Consent & Global Privacy Control

VHUES and its service providers may use:

  • Essential cookies

  • Functional cookies

  • Analytics technologies

  • Personalization technologies

  • Advertising cookies or pixels

  • Similar storage or tracking technologies

Essential technologies may operate where necessary to provide or secure the Services.

Where applicable law requires consent before non-essential technologies are used, those technologies will be managed according to the consent choices presented to the customer.

Advertising and analytics providers may include:

  • Google, including GA4 and Google Ads

  • Meta

  • TikTok

  • Pinterest

  • Other providers identified through the applicable consent interface

Where legally required and technically applicable, VHUES honors recognized browser-based privacy signals such as Global Privacy Control (GPC).

Cookie and privacy choices may also be available through Shopify-powered privacy controls where implemented on the Website.

6) Relationship With Shopify

Our online store is powered by Shopify.

Shopify processes personal information in connection with operating the ecommerce platform and may process certain information under its own privacy terms and legal responsibilities.

Depending on the service and context, Shopify may process information to:

  • Operate checkout and ecommerce services

  • Maintain customer accounts

  • Process payments

  • Support fraud prevention

  • Provide customer-facing Shopify services

  • Operate store functionality

  • Provide analytics and technical services

Customers should review Shopify's applicable privacy notices for information about Shopify's own processing activities.

6.1 Shopify Inbox & AI-Assisted Chat

VHUES uses Shopify Inbox, including AI-assisted customer-chat functionality where enabled.

When a customer uses Shopify Inbox, Shopify may process information associated with that interaction, including:

  • Chat communications

  • Device and activity information

  • Customer information made available through Shopify

  • Relevant order or account information

  • Store, product, inventory, and policy information used to assist with responses

AI-powered Inbox functionality may use this information to generate and personalize responses and to operate or improve Shopify's services in accordance with Shopify's applicable terms and privacy policies.

Where a customer is signed in through Shopify or Shop, Shopify-powered functionality may be able to use additional account or purchase information according to Shopify's features, settings, and privacy practices.

Customers should avoid submitting unnecessary sensitive personal information through store chat.

7) Service Providers & Third Parties

VHUES may disclose personal information to service providers where reasonably necessary to operate the business and provide the Services.

Examples may include:

Commerce & Payments

  • Shopify

  • Shopify Payments

  • Stripe

  • PayPal

  • Other payment methods selected by the customer

Marketing & Analytics

  • Google

  • Meta

  • TikTok

  • Pinterest

  • Klaviyo

Messaging & Customer Communication

  • Shopify Inbox

  • ManyChat

  • Email or messaging providers

Forms

  • Typeform

Operations, Manufacturing & Fulfillment

  • Manufacturing partners

  • Fulfillment providers

  • Warehousing providers where applicable

Shipping & Delivery

Depending on destination and fulfillment arrangements, this may include carriers such as:

  • Canada Post

  • USPS

  • UPS

  • FedEx

  • Chit Chats

  • Other carriers or logistics providers

Reviews

This may include providers such as Trustpilot where applicable.

Only information reasonably necessary for the applicable service is disclosed.

Text-message opt-in information is not sold, and SMS consent data is not disclosed to third parties for their own unrelated marketing purposes.

8) Other Disclosures We May Make

We may disclose personal information:

  • To service providers acting on our behalf

  • To payment and fraud-prevention providers

  • To carriers and fulfillment providers

  • To professional advisers where reasonably necessary

  • In connection with a merger, acquisition, financing, restructuring, sale, or similar corporate transaction

  • To courts, regulators, law enforcement, or government authorities where legally required or permitted

  • To investigate fraud, abuse, security threats, or unlawful conduct

  • To protect legal rights or safety

  • At your direction

  • With your consent

  • As otherwise permitted or required by law

9) Selling, Sharing & Targeted Advertising

VHUES does not sell personal information for money.

Some disclosures involving advertising cookies, identifiers, or online activity may be considered:

  • A “sale”

  • “Sharing”

  • “Targeted advertising”

under certain U.S. state privacy laws even where no money is exchanged.

Where such laws apply, customers may have a right to opt out.

VHUES may use or disclose limited identifiers, device information, and online activity for advertising measurement, attribution, or retargeting, subject to:

  • Applicable consent requirements

  • Cookie choices

  • GPC signals where legally required

  • Other applicable opt-out rights

We do not knowingly sell or share personal information of children where prohibited by law.

10) Retention

VHUES retains personal information only for as long as reasonably necessary for the purposes for which it was collected, including legal, accounting, security, fraud-prevention, and dispute-resolution requirements.

Typical retention periods may include:

Orders, Tax & Accounting Records

Generally up to 7 years, or longer where required by applicable law.

Customer Support, Returns & Order Communications

Generally up to 24 months after the interaction or resolution, unless longer retention is reasonably required for legal, safety, fraud-prevention, warranty, or dispute purposes.

Marketing Subscriptions

Until the customer unsubscribes or the information is otherwise removed in accordance with applicable retention practices.

Inactive marketing records may be removed or suppressed after an appropriate period.

Analytics

Typically approximately 14–26 months, depending on the applicable provider and configuration.

Quiz & Form Responses

Generally up to 24 months, unless deleted earlier or reasonably required for an ongoing customer relationship.

Different periods may apply where a service provider maintains information under its own legal obligations or retention practices.

11) Security

VHUES uses reasonable administrative, technical, and organizational safeguards appropriate to the nature and sensitivity of personal information under our control.

These may include measures relating to:

  • Access control

  • Account security

  • Payment-provider security

  • Secure ecommerce infrastructure

  • Restricted internal access

  • Service-provider selection

  • Fraud prevention

No website, network, storage system, or electronic transmission can be guaranteed to be completely secure.

Customers should avoid transmitting highly sensitive information through unsecured channels or where it is not necessary for VHUES to provide the requested service.

12) Privacy Breaches

VHUES maintains procedures intended to identify, assess, contain, document, and respond to privacy and security incidents.

Where a breach triggers notification or reporting obligations under applicable law, VHUES will notify affected individuals, regulators, or other required parties within the legally required timeframe.

Different laws apply different reporting thresholds.

For example:

  • Under applicable Canadian federal privacy law, notification and regulatory reporting may be required where a breach creates a real risk of significant harm

  • Under the EU or UK GDPR, different regulatory and individual-notification thresholds may apply based on the risk to individuals' rights and freedoms

  • Other jurisdictions may impose different standards

VHUES will apply the legally applicable threshold rather than a single global breach standard.

Where required by applicable law, records of privacy breaches will also be maintained.

13) Your Privacy Rights & Choices

Privacy rights vary by jurisdiction.

Depending on where you live and which law applies, you may have rights concerning:

  • Access to personal information

  • Correction of inaccurate information

  • Deletion

  • Portability

  • Withdrawal of consent

  • Objection to certain processing

  • Restriction of processing

  • Opting out of targeted advertising

  • Opting out of sale or sharing as legally defined

  • Certain automated decision-making or profiling

  • Making a privacy complaint

  • Other rights provided by applicable law

To submit a privacy request, contact:

privacy@vhues.ca

Please describe the request and provide enough information for us to identify the relevant account or interaction.

VHUES may need to verify identity before completing certain privacy requests.

We will not discriminate against an individual for lawfully exercising an applicable privacy right.

Requests will be handled within the timeframe required by applicable law.

13.1 Marketing Choices

Marketing emails may be unsubscribed from using the unsubscribe link included in the message.

Where SMS marketing is offered, applicable opt-out instructions will be provided with the service.

Withdrawing from marketing does not prevent VHUES from sending necessary transactional communications, such as:

  • Order confirmations

  • Shipping updates

  • Return communications

  • Refund notices

  • Cancellation confirmations

  • Security notices

  • Customer-support responses

14) International Data Transfers

VHUES BEAUTY is based in British Columbia, Canada.

Personal information may be processed or stored in other provinces, the United States, Europe, or other jurisdictions by Shopify and other service providers used to operate the Services.

As a result, personal information may be subject to the laws of the jurisdiction in which it is processed.

Where applicable law requires specific safeguards for international transfers of personal information, VHUES will use or rely on legally permitted transfer mechanisms and safeguards.

VHUES remains responsible for personal information under its control to the extent required by applicable law.

15) Canadian Privacy Law & Complaints

VHUES BEAUTY is a private-sector organization established in British Columbia.

Depending on the processing activity, Canadian privacy laws applicable to VHUES may include:

  • British Columbia's Personal Information Protection Act (PIPA)

  • Canada's federal Personal Information Protection and Electronic Documents Act (PIPEDA), including where personal information is handled in interprovincial or international commercial transactions

  • Other applicable Canadian privacy requirements

If you have a concern about how VHUES handles personal information, please contact us first at:

privacy@vhues.ca

We will review privacy complaints and respond appropriately.

Depending on the circumstances and applicable law, individuals may also have a right to contact an appropriate privacy regulator, including:

  • The Office of the Information and Privacy Commissioner for British Columbia

  • The Office of the Privacy Commissioner of Canada

  • Another applicable provincial, territorial, national, or international privacy authority

Nothing in this Policy requires an individual to waive a right to contact a regulator.

16) Privacy Accountability & Data Protection Officer

VHUES has assigned internal responsibility for privacy compliance and privacy requests.

Privacy matters may be directed to:

privacy@vhues.ca

Canadian privacy-law accountability requirements do not necessarily require the person responsible for privacy compliance to hold the formal title of Data Protection Officer (DPO).

VHUES has not identified a separate DPO in this Policy.

Where applicable law requires appointment of a formal Data Protection Officer, VHUES will make the required appointment and provide the applicable contact information.

17) European Economic Area & United Kingdom

VHUES BEAUTY is established in Canada and does not have an establishment in the European Economic Area or United Kingdom.

VHUES may offer goods or services to customers located in the EEA and United Kingdom.

Accordingly, the EU GDPR or UK GDPR may apply to certain VHUES processing activities where the applicable territorial-scope requirements are met.

Where those laws apply, VHUES will process personal information in accordance with the applicable requirements, including relevant rights, transparency obligations, lawful-basis requirements, and transfer requirements.

17.1 EEA & UK Representatives

Under applicable EU and UK privacy law, an organization established outside those jurisdictions may be required to appoint a local representative where it offers goods or services to individuals there or monitors their behaviour.

Applicable law also provides limited exceptions to the representative requirement in certain circumstances.

Where VHUES is legally required to appoint an EEA or UK representative, the representative's contact information will be made available in this Privacy Policy or another appropriate privacy notice.

Where an applicable statutory exception removes that requirement, no representative is required.

Nothing in this section should be interpreted as limiting any right available to individuals under the EU GDPR, UK GDPR, or applicable national law.

18) Changes to This Privacy Policy

VHUES may update this Privacy Policy from time to time to reflect:

  • Changes to our Services

  • Changes to service providers

  • Changes to technology

  • Changes to legal requirements

  • Changes to privacy practices

  • New functionality

Updates will be identified by a revised Last Updated date.

Where applicable law requires additional notice or consent for a material change, VHUES will provide that notice or obtain that consent as required.

19) Who We Are & How to Contact Us

For personal information handled by VHUES in connection with its own business purposes:

Controller / Organization: VHUES BEAUTY
Trade Name: VHUES Beauty
Registered in: British Columbia, Canada

Business Number (BN): 745328625BC0003
Corporate Registry Number: FM1086123

Phone: +1 (604) 359-6565
General Support: support@vhues.ca
Privacy Requests & Complaints: privacy@vhues.ca

For questions about this Privacy Policy or the handling of personal information, contact:

privacy@vhues.ca